Comment 1:
Security is a “system” concept.
Follow-up:
Yes it is very important for us (the users) to understand this so that we will not have a false sense of security when we are “educated” that our data are encrypted. Now you know that data encryption is just part of the whole process. Anything goes wrong in other parts of the system, security cannot be promised.
Comment 2:
HTTPS protocol?
Follow-up:
This is the so-called “secure” version of the HTTP protocol. Basically, this protocol transports
encrypted data instead of sending data in plaintext. The data is usually encrypted using a symmetric key system for which the shared key has to be agreed using a public key approach. Please refer to Problem 3 of Tutorial 5 for the design of such a key set-up protocol.
Comment 3:
Stealing bank account information from the Internet?
Follow-up:
Yes whether you like it or not, this kind of things are believed to be happening all the time! The thing is it is not very difficult to identify a “weakest” link in the system (e.g., a particular e-commerce Web site). It is widely believed that after such a system is broken, the hacker will not just use the bank account information (e.g., for buying things) but he/she will hold the bank and/or the e-commerce Web site for ransoms.
Comment 4:
What is symmetric key cryptography?
Follow-up:
Symmetric key system has always been the most important way for data confidentiality, despite that public key system is shown to be more versatile and “strong”. The reason is that symmetric key algorithms are usually much much faster than the public key algorithms. In a typical symmetric key system, a shared key has to be agreed upon through some means (see Comment 2 above). Then, the communicating parties will use the shared key for doing encryption/decryption.
Comment 5:
Are there any more sophisticated cryptography techniques?
Follow-up:
One of the most notable sophisticated cryptography techniques is the elliptic curve cryptography,
which is based on yet another branch of mathematics (also related to number theory) to perform
encryption and decryption.
Comment 6:
Public key cryptography. RSA algorithm?
Follow-up:
We have already worked extensively on this in Tutorial 5.
Comment 7:
Difference between public key and symmetric key cryptography.
Follow-up:
The most important difference is, NOT the strength, but the way keys are distributed/shared.
Showing posts with label security. Show all posts
Showing posts with label security. Show all posts
Monday, November 14, 2011
Friday, October 28, 2011
Mobile Device Security: iOS vs Android
Nowadays, it is not uncommon to observe most people around have a mobile device such as smartphone and tablet computer. These devices allow us to stay connected 24/7. The ability for the users to install applications has expanded their usability and thus increased their popularity. However, only a few users are aware of the security aspects of this technology. In this survey, I will compare security features of the two most popular mobile platforms: Apple’s iOS and Google’s Android.
Both iOS and Android have built in security features that were implemented based on four pillars: Application provenance, encryption, isolation, and permission-based access control.
Application Provenance
Application provenance is the technique used to ensure application authors and distributors have an identity that tides to the application.
Apple takes a tight provenance approach to ensure the authenticity of the iOS applications. Every application must be signed by an Apple-issued digital certificate. Apple will verify the identity of the developer and company before issuing such a certificate. Moreover, with the exception of the applications developed under Apple’s iOS Developer Enterprise program, all iOS applications must be published through Apple’s App Store and are subject to vetting by Apple. With a few exceptions, Apple’s approach has been proven to be quite effective.
On the other hand, Google took a relatively loose provenance approach. Although every Android application also must be digitally signed by a certificate, it does not have to be a Google-issued certificate. You can even self-sign the application with an anonymous certificate. To make the matter worse, applications may be posted on the Android Market without vetting by Google, and publishing applications through other channels such as the developer’s website is also allowed. As a result, an attacker can potentially attach malicious codes to a legitimate application, self-signed it and publish it on a website and those non-tech savvy users probably will not notice the differences. As a result, Android is more prone to attacks through polymorphic malware and trojanized legitimate applications.
Encryption
Encryption is the technique used to prevent data loss through unauthorized access. Without the decryption key, the data will look like garbage.
On the latest iOS devices, all data stored in the internal flash memory are encrypted using hardware-accelerated AES-256 encryption. iOS will automatically decrypt the data when it was read. Other data such as email and attachments can be secondarily encrypted by a user passcode. However, such an encryption scheme only provides little protection. A simple jailbreak will allow the attacker to read most of the data including the passwords stored because iOS stores a copy of the decryption key around to decrypt data for the applications running in the background.
Until the recent Android 3.0 release, there was no built-in encryption support on Android devices. Which means most of the Android devices on the market solely relies on the application to conceal sensitive data using the Java encryption API. Otherwise, all data are stored unencrypted on the device. So Android isn’t any better in terms of data loss protection.
Isolation (Sandboxing)
Sandboxing is the technique used to limit access to data and systems. Applications are therefore isolated from each other and the OS.
Applications running on the iOS can only access to a limited set of data such as contacts, calendar and the device ID. But they are blocked from accessing the emails and SMS inbox. User inputs is required if they want to do more, such as initiating phone calls and sending SMS messages. Also, applications are limited to user-mode ones and are blocked from accessing other applications’ data or enumerating other applications and the OS. This isolation model is effective on keeping the applications from causing too much mischief but at the same time also limits the ability to create iOS security applications.
Android on the other hand relies on its Dalvik virtual machine to enforce the isolation. Just like other Java-based platforms, applications on Android are run within its own virtual machine, which is isolated in its own process. Applications are also limited to user-mode ones and are blocked from accessing most system services by default. Although Android limits application’s access to other application’s private data, it allows applications to enumerate and examine other application’s codes. Also, data stored on the external SD card can be read by all applications by default. With the exception of the SD card, Android has an even stricter default isolation model than the iOS and the ability to access other application’s codes make it easier to create security applications.
Permission-based Access Control
Permission-based access control is the technique used to limit access to the data and systems to the ones granted by the policy.
Apple hardwires the access policy into iOS. The only exceptions are the permissions to access to the GPS location data, receive alert notifications, initiation phone calls, and send out emails and SMS messages, which the application can prompt the user and request for permission. So iOS applications do not really have any control over most of their permissions
Unlike iOS, Andriod applications may request granular permission to almost every subsystem. Developers explicitly state the set of permission at compile time and the user can either accept or reject all permissions at install time. While this approach provides greater flexibility to the application developers, it also relies on the user to decide whether it is safe to grant the requested permissions. With over a hundred of different permissions an application can request for, it is difficult for an average user to make such a security decision. This leaves a giant security hole in Andriod.
After reviewing both features of two mobile operating systems, it is obvious that they are different system. Although both platforms are designed with security in mind, users cannot solely rely on these security features to protect their data as there are weakness in both platforms which could open up to attacks. While it is convenient to use these mobile devices to stay connected, users should also be aware of the security implications, and be more educated about mobile security so that they can better safeguard their data.
References:
1. Android Developers. (2011). The Developer’s Guide. Retrieved from http://developer.android.com/guide /index.html
2. iOS Developer Library. (2010). iOS Development Workflow Guide. Retrieved from https://developer.apple.com/library/ios/#documentation/Xcode/Conceptual/ios_development_workflow/000-Introduction/introduction.html%23//apple_ref/doc/uid/TP40007959
3. iOS Developer Library. (2010). Security Overview. Retrieved from https://developer.apple.com/library/ios/#documentation/Security/Conceptual/Security_Overview/Concepts/Concepts.html%23//apple_ref/doc/uid/TP30000976-CH203-TPXREF106
4. Nachenbery, C. (2011). A Window Into Mobile Device Security. Retrieved from http://www.symantec.com/content/en/us/enterprise/white_papers/b-mobile-device-security_WP.en-us.pdf
Both iOS and Android have built in security features that were implemented based on four pillars: Application provenance, encryption, isolation, and permission-based access control.
Application Provenance
Application provenance is the technique used to ensure application authors and distributors have an identity that tides to the application.
Apple takes a tight provenance approach to ensure the authenticity of the iOS applications. Every application must be signed by an Apple-issued digital certificate. Apple will verify the identity of the developer and company before issuing such a certificate. Moreover, with the exception of the applications developed under Apple’s iOS Developer Enterprise program, all iOS applications must be published through Apple’s App Store and are subject to vetting by Apple. With a few exceptions, Apple’s approach has been proven to be quite effective.
On the other hand, Google took a relatively loose provenance approach. Although every Android application also must be digitally signed by a certificate, it does not have to be a Google-issued certificate. You can even self-sign the application with an anonymous certificate. To make the matter worse, applications may be posted on the Android Market without vetting by Google, and publishing applications through other channels such as the developer’s website is also allowed. As a result, an attacker can potentially attach malicious codes to a legitimate application, self-signed it and publish it on a website and those non-tech savvy users probably will not notice the differences. As a result, Android is more prone to attacks through polymorphic malware and trojanized legitimate applications.
Encryption
Encryption is the technique used to prevent data loss through unauthorized access. Without the decryption key, the data will look like garbage.
On the latest iOS devices, all data stored in the internal flash memory are encrypted using hardware-accelerated AES-256 encryption. iOS will automatically decrypt the data when it was read. Other data such as email and attachments can be secondarily encrypted by a user passcode. However, such an encryption scheme only provides little protection. A simple jailbreak will allow the attacker to read most of the data including the passwords stored because iOS stores a copy of the decryption key around to decrypt data for the applications running in the background.
Until the recent Android 3.0 release, there was no built-in encryption support on Android devices. Which means most of the Android devices on the market solely relies on the application to conceal sensitive data using the Java encryption API. Otherwise, all data are stored unencrypted on the device. So Android isn’t any better in terms of data loss protection.
Isolation (Sandboxing)
Sandboxing is the technique used to limit access to data and systems. Applications are therefore isolated from each other and the OS.
Applications running on the iOS can only access to a limited set of data such as contacts, calendar and the device ID. But they are blocked from accessing the emails and SMS inbox. User inputs is required if they want to do more, such as initiating phone calls and sending SMS messages. Also, applications are limited to user-mode ones and are blocked from accessing other applications’ data or enumerating other applications and the OS. This isolation model is effective on keeping the applications from causing too much mischief but at the same time also limits the ability to create iOS security applications.
Android on the other hand relies on its Dalvik virtual machine to enforce the isolation. Just like other Java-based platforms, applications on Android are run within its own virtual machine, which is isolated in its own process. Applications are also limited to user-mode ones and are blocked from accessing most system services by default. Although Android limits application’s access to other application’s private data, it allows applications to enumerate and examine other application’s codes. Also, data stored on the external SD card can be read by all applications by default. With the exception of the SD card, Android has an even stricter default isolation model than the iOS and the ability to access other application’s codes make it easier to create security applications.
Permission-based Access Control
Permission-based access control is the technique used to limit access to the data and systems to the ones granted by the policy.
Apple hardwires the access policy into iOS. The only exceptions are the permissions to access to the GPS location data, receive alert notifications, initiation phone calls, and send out emails and SMS messages, which the application can prompt the user and request for permission. So iOS applications do not really have any control over most of their permissions
Unlike iOS, Andriod applications may request granular permission to almost every subsystem. Developers explicitly state the set of permission at compile time and the user can either accept or reject all permissions at install time. While this approach provides greater flexibility to the application developers, it also relies on the user to decide whether it is safe to grant the requested permissions. With over a hundred of different permissions an application can request for, it is difficult for an average user to make such a security decision. This leaves a giant security hole in Andriod.
After reviewing both features of two mobile operating systems, it is obvious that they are different system. Although both platforms are designed with security in mind, users cannot solely rely on these security features to protect their data as there are weakness in both platforms which could open up to attacks. While it is convenient to use these mobile devices to stay connected, users should also be aware of the security implications, and be more educated about mobile security so that they can better safeguard their data.
References:
1. Android Developers. (2011). The Developer’s Guide. Retrieved from http://developer.android.com/guide /index.html
2. iOS Developer Library. (2010). iOS Development Workflow Guide. Retrieved from https://developer.apple.com/library/ios/#documentation/Xcode/Conceptual/ios_development_workflow/000-Introduction/introduction.html%23//apple_ref/doc/uid/TP40007959
3. iOS Developer Library. (2010). Security Overview. Retrieved from https://developer.apple.com/library/ios/#documentation/Security/Conceptual/Security_Overview/Concepts/Concepts.html%23//apple_ref/doc/uid/TP30000976-CH203-TPXREF106
4. Nachenbery, C. (2011). A Window Into Mobile Device Security. Retrieved from http://www.symantec.com/content/en/us/enterprise/white_papers/b-mobile-device-security_WP.en-us.pdf
Friday, October 21, 2011
Is it secure to shop online?
With the growing in popularity in surfing the internet among the public across the decade, online shopping has become a widespread activity in our daily life. No matter what you can think of, almost all the products and service are available on the internet, which vary from groceries to clothes, from cars to house. A research conducted by Pew Internet in 2008 revealed that over half (66%) of the online American admitted that they have purchased a product online, and most of them thought that it is convenient (78%) and time saving (68%). Despite the benefits online shopping bring us, it draws some concerns over the security problem of data transmission. 75% of internet users worried about the safety of sending personal details or financial information such as the credit card number over the internet. Is it safe to shop online? How to ensure the security of online shopping or e-commerce? What can we do to protect our personal information from leakage? In this survey, I would like to focus on the precautionary measures to better protect ourselves so as to enjoy a safe and comfortable online shopping experience.
1. Web sites with secure transmission
The first measure is to look for secure web sites which use the secure transmission standard such as Secure Sockets Layer (SSL) and Secure Electronic Transaction (SET). It ensures secure transmission of data between a web site and its client by using Public Key Infrastructure (PKI). When sensitive data is needed to sent over the internet from the client, the public key of the web site is obtained to encrypt the data. It can only be decrypted by using the company’s own private key which must be kept secret, ensuring the security and maintaining the confidentiality of the message no matter when it is intercepted during transmission. An SSL web site can be identified by a symbol of a closed lock icon in the status bar or the protocol prefix “https” in the Uniform Resources Locator (URL). (Chan W. N., 2005) The following is a web site with SSL.
2. Verifying a site by Digital Certificate
Using a digital certificate is another way to verify a web site to see if it is secure. It is a digital document including the name and the public key of a person or an organization, which is used to verify or identify that a person or an organization sending a message is who he or she claims to be. Checking the digital certificate of a web site by clicking the lock icon on the browser can easily ensure the security of transaction with the web site.
3. Looking for the Web Site's Privacy Statement
Checking out the “Privacy and Security Policy” of the web site can give you a clearer understanding on how your data is processed. To be more specific, you can find out what type of information is collected by the web site, whether your information is shared with a third party and how it is shared. If your data is allowed to be marketed to others, you can probably expect to receive spam mails.
4. Be Aware of Cookies
Cookies are a small chunk of data generated by a dynamic web page and stored in a text file on your computer’s hard disk. (Chan W. N., 2005). It is an online tracking system that stores information such as your login name and even your password you sign in a site, the web sites you visit as well as your shopping and surfing habits. This data is useful for the companies to select and promote their products and services to you through targeted advertisements which suit your interests and shopping patterns. It is a common and useful marketing tactics for the companies to expose their products to their potential customers, which in turn has a higher chance to earn a greater profit. However, this data are stored secretly without your active consent. All this information may combine to form a detailed profile and may be transmitted to the third parties in the worst case. Although you are allowed to set your security settings to disable cookies, you may possibly not be able to make online purchase from e-commerce web site where cookies are needed for running the shopping carts.
5. Using single-use credit card numbers
Since your credit card number can be easily stolen from the customers’ databases by hackers, it is not secure to use it for online shopping. To tackle this problem, it is suggested to use the single-use credit card numbers or “virtual credit cards” to make purchase, which the substitute account number is generated on a random based for one-time usage only. This method can effectively keep your actual card number hidden while performing the transaction. Due to the single usage in nature, it can’t be used again for other purchase even if the card number is stolen from a hacker.
In conclusion, there are pros and cons in conducting e-commerce. It indeed brings us convenience and fun in shopping online without the restriction of the geographical boundaries and time factors. The number of online shopper will be soared rapidly if the public’s concern over the security and privacy problem of data transmission can be addressed. You may find the advice above useful in protecting your sensitive data while enjoying the fun of e-commerce.
Reference
- Chan, W.N. (2005). Computer concepts. Hong Kong: Radian Publishing Co.
- Chan, W.N. (2005). Data communication & networking. Hong Kong: Radian Publishing Co.
- Horrigan, J. (2008) Online Shopping. Retrieved from http://www.pewinternet.org/Reports/2008/Online-Shopping/01-Summary-of-Findings.aspx
- Online Shopping and Security (n.d.) Retrieved October 4, from http://www.extension.iastate.edu/publications/pm1789g.pdf
- Online Shopping and Tips: E-Commerce and You (2011) Retrieved from https://www.privacyrights.org/fs/fs23-shopping.htm
Sunday, October 16, 2011
Microblogging
Wong Kwan Ting
Introduction
Recent years, microblogging is very popular all over the world. Microblogging is a type of blogging, but it has a small scale than blogging. In a microblog, users are only allowed to post small content within 140 words or a photo only. Nowadays, it is more and more convenient to surf the Internet everywhere. People are able to connect to the Internet by their smart phones and they can update their microblogs no matter where they are. The most famous companies which provide microblogging services include Twitter, Weibo and Plurk.
History of Microblogging
The history of microblogs starts from 2005 and it was called tumblelogs at that time. It was a simpler type of blog which was a quick and good platform to publish people’s work on the Internet. After one year, the term “microblogs” was used by Twitter instead of “tumblelogs”. Then, more and more companies start to provide microblogging services and each of the providers has its own characteristics. For instance, Plurk has a timeline view which shows the statuses, photos and videos of the user in a form of timeline. This helps people share information and news more quickly and efficiently. Due to the fast development of the sharing platforms on the Internet, the Internet has become a place where breaking news and new ideas come out. The news and ideas can usually spread all over the world after a short period of time.
Benefits of Microblogging to the Business
The main characteristic of microblogging is the function “follow”. The microblog users are able to follow other users so that the most updated statuses or photos are pushed to the followers’ news feeds. The followers are able to choose what updates they want to get. Moreover, as microblogs are mainly public to all people, microblogging is a very good platform to promote business. Because of the popularity of microblogging, a lot of corporations, such as Dell, Apple and Microsoft, have microblogs on Twitter or other microblogging service providers to deliver their exclusive news or most updated products and services to the public. For instance, Microsoft posted a video of the new Xbox Live Experience on their Twitter recently. The video is just like an advertisement or a TV commercial on the Internet but it is totally free of charge. The companies do not need to pay a cent to publicize their products and services on the microblogs. The microblogs are also good places for marketing and public relations. The Sysomos study reveals that the group of marketers is more active than general users on Twitter. 15% of the marketers follow more than 2000 people but only 0.29% of the general users follow more than 2000 people. [1] Apart from companies, the film stars and singers from Hong Kong, Taiwan and the mainland China are very common to use Weibo to share their daily life to their fans. Through microblogs, the stars are able to promote their recent work. Furthermore, they can build up a good image to their fans and the public. This could help them attract more opportunities on working. Hence, microblogging is also a great and convenient promotion platform to the public figures.
Privacy and Security on Microblogging
Apart from the benefits that microblogging brings, there are some issues which we need to aware. For instance, privacy is a main concern on microblogging. The users of microblogs may post some personal information such as telephone numbers or addresses on their microblogs. As their microblogs may be seen by the public, the personal information may spread at a very fast rate. Moreover, it is not secure even if the users set up privacy on their microblogs. For instance, Google’s Buzz platform automatically publicizing their users’ email contacts as followers in 2010. [2] This aroused a controversy to the users and Google later edited the settings. Besides, hackers may have access to the server of the microblogging service providers and steal the users’ information. As a result, the users of microblogs should not rely on the providers very much and they should be careful before posting their personal information on their microblogs.
Freedom of Speech on Microblogging
The freedom of speech on the microblogs is also a concern on society. This issue mainly affects the users of microblogs in the mainland China, especially the users of Weibo. For instance, Weibo would filter the posts or photos which are related to the June Fourth Incident or sensitive information considering the Chinese government. The Internet should be a platform which allows every one expressing their opinions and ideas freely. The action of deleting statuses is very annoying to the users since they are not allowed to express what they are thinking. This matter leads to a controversy to the microblog users and the microblogging service providers. It is also a new social issue to society in Hong Kong and the mainland China.
Conclusion
In conclusion, microblogging help us spread our ideas and the news to the world more quickly. More and more people are able to exchange their information via microblogs. Nonetheless, the convenience may lead to some side-effects. The privacy and security of microblogs are still doubtful to the users. Furthermore, freedom of speech on microblogs also leads to a controversy on society in recent years. We should identity the benefits and demerits of microblogging and think twice on how we use microblogs.
References
Introduction
Recent years, microblogging is very popular all over the world. Microblogging is a type of blogging, but it has a small scale than blogging. In a microblog, users are only allowed to post small content within 140 words or a photo only. Nowadays, it is more and more convenient to surf the Internet everywhere. People are able to connect to the Internet by their smart phones and they can update their microblogs no matter where they are. The most famous companies which provide microblogging services include Twitter, Weibo and Plurk.
History of Microblogging
The history of microblogs starts from 2005 and it was called tumblelogs at that time. It was a simpler type of blog which was a quick and good platform to publish people’s work on the Internet. After one year, the term “microblogs” was used by Twitter instead of “tumblelogs”. Then, more and more companies start to provide microblogging services and each of the providers has its own characteristics. For instance, Plurk has a timeline view which shows the statuses, photos and videos of the user in a form of timeline. This helps people share information and news more quickly and efficiently. Due to the fast development of the sharing platforms on the Internet, the Internet has become a place where breaking news and new ideas come out. The news and ideas can usually spread all over the world after a short period of time.
Benefits of Microblogging to the Business
The main characteristic of microblogging is the function “follow”. The microblog users are able to follow other users so that the most updated statuses or photos are pushed to the followers’ news feeds. The followers are able to choose what updates they want to get. Moreover, as microblogs are mainly public to all people, microblogging is a very good platform to promote business. Because of the popularity of microblogging, a lot of corporations, such as Dell, Apple and Microsoft, have microblogs on Twitter or other microblogging service providers to deliver their exclusive news or most updated products and services to the public. For instance, Microsoft posted a video of the new Xbox Live Experience on their Twitter recently. The video is just like an advertisement or a TV commercial on the Internet but it is totally free of charge. The companies do not need to pay a cent to publicize their products and services on the microblogs. The microblogs are also good places for marketing and public relations. The Sysomos study reveals that the group of marketers is more active than general users on Twitter. 15% of the marketers follow more than 2000 people but only 0.29% of the general users follow more than 2000 people. [1] Apart from companies, the film stars and singers from Hong Kong, Taiwan and the mainland China are very common to use Weibo to share their daily life to their fans. Through microblogs, the stars are able to promote their recent work. Furthermore, they can build up a good image to their fans and the public. This could help them attract more opportunities on working. Hence, microblogging is also a great and convenient promotion platform to the public figures.
Privacy and Security on Microblogging
Apart from the benefits that microblogging brings, there are some issues which we need to aware. For instance, privacy is a main concern on microblogging. The users of microblogs may post some personal information such as telephone numbers or addresses on their microblogs. As their microblogs may be seen by the public, the personal information may spread at a very fast rate. Moreover, it is not secure even if the users set up privacy on their microblogs. For instance, Google’s Buzz platform automatically publicizing their users’ email contacts as followers in 2010. [2] This aroused a controversy to the users and Google later edited the settings. Besides, hackers may have access to the server of the microblogging service providers and steal the users’ information. As a result, the users of microblogs should not rely on the providers very much and they should be careful before posting their personal information on their microblogs.
Freedom of Speech on Microblogging
The freedom of speech on the microblogs is also a concern on society. This issue mainly affects the users of microblogs in the mainland China, especially the users of Weibo. For instance, Weibo would filter the posts or photos which are related to the June Fourth Incident or sensitive information considering the Chinese government. The Internet should be a platform which allows every one expressing their opinions and ideas freely. The action of deleting statuses is very annoying to the users since they are not allowed to express what they are thinking. This matter leads to a controversy to the microblog users and the microblogging service providers. It is also a new social issue to society in Hong Kong and the mainland China.
Conclusion
In conclusion, microblogging help us spread our ideas and the news to the world more quickly. More and more people are able to exchange their information via microblogs. Nonetheless, the convenience may lead to some side-effects. The privacy and security of microblogs are still doubtful to the users. Furthermore, freedom of speech on microblogs also leads to a controversy on society in recent years. We should identity the benefits and demerits of microblogging and think twice on how we use microblogs.
References
- Inside Twitter: An In-depth Look Inside the Twitter World. Sysomos; 2009-06-10. Retrieved 2009-06-23.
- Google Buzz redesigned after privacy complaints. The Telegraph (London); February 15, 2010. Retrieved March 25, 2010.
Wednesday, September 28, 2011
Discuss Smart Phone in a sociology percepts
Introduction
In Hong Kong, It is common to a person using a smart phone, and it is important to state that the popularity of smart phone is increasing. For example, when we are on the street, normally we can see people using Iphone, Samsung galaxy series, etc. It means that smart phone do attract people to use it selves. With the increasing popularity of smart phone , a lot of questions are also raised: Why smart phones are so attractive? How the smart phone change the society? In this essay, this phenomenon will be discussed in a sociology percept. First of all, the reason for the extra high popularity of smart phone will be discussed. The essay will then be followed by discussing the effect of smart phone on the society.
1)The reason for the high popularity of smart phone
There are two reasons explaining why a lot of people choose smart phone rather than mobile phones, mainly ,in terms of security and convenience .
1a) In terms of security
Owing to the fact that Hong Kong is a city of business and a lot of people are working in the business aspect, people need to handle a lot of data of their work and transfer the data to their client through their self phone. Moreover, as some data of their work may be confidential, it Is necessary for the phone to be secure enough so that all the data can be confirmed not to be stolen. For smart phone , since some smart phone are known to be secure, many businessman choose it to help their work. Take blackberry as an example, owing to the fact that the operating system of blackberry are set to be very secure when compared with other phones, blackberry attracts a lot of people to use it . Apart from blackberry, the operating system - Symbian, which is invented by Nokia, is also secure so it attracts many people to use it rather than mobile phone.
1b) In terms of convenience
In the smart phone market, apart from some brands which are very famous in data security, there are also some brands which are famous in the large variety of applications. They are : IPhone OS , Android and Windows mobile. These Operating system provide a large variety of applications. This large variety of applications convince user to do their job. For examples, google maps and bus routes searching application. These applications are very convenient to user to get their job done. Moreover, IPhone OS and Android provide a platform for user to create their own application. This allows applications to have a much higher variety. The characteristic of smart phone that having a lot of applications do attract people very much since it can convince them very much.
2)The effect of smart phone to the society
Since the popularity of smart phone is on the increase, more and more people are affected by this kind of gadget. Therefore, it is important to look at the effect of smart phone on the society.
2a) Boosting the development of application
In the past, application mainly are developed by big companies and people seldom join the development. However, the situation has changed once the smart phone such as IPhone and android system released. Smart phone boost the development of application. The reason is that , as mentioned in above, some smart phone ( IPhone and Android) opens a new platform for user to develop its own application so as to fit their requirement. That is to say, everyone is now have the chance to join the application development. This converge of labor do help the development of new applications.
2b) Open a new market and create new jobs
As mentioned before, some type of smart phone open a new platform for user to share their application. This new platform also create a new market, that is , application market . Take IPhone as an example, Apple company gives a platform called Apple Store for IPhone users to buy applications so as to evaluate their phone. A market is formed which people can buy applications there. Moreover, apart from opening a new market, this new platform also create a new business. Since there is a high demand for applications in the market, some people choose to develop new applications and sell it to other people so as to earn money. This states that Smart Phone do create a new business .
2c) Creating a culture of movable business
Some Smart Phone ,such as blackberry ,are said to be very secure and a lot of businessman to choose to do business through their smart phone. This create a new culture of mobile business that people are now use their selfphone to do business with others. For example, people may sign a contract through smart phone. Therefore, people can now do business everywhere. That is to say, Smart Phone convince businessman to do business in outdoor.
3) Some critical thinking about Smart Phone
Although Smart Phone is said to be very secure, and convenient, it is important for us to think some questions: Do Smart Phone really that good? Do smart phone really secure? Actually, there are many unknown area that we do not know well about smart phone. It is important to state that we should not trust smart phone very much. Even though everyone said that they are secure, it still has the chance of information leakage. Moreover, since your mobile phone always access to the open network, information may be stolen and changed, which may cause a big problem in both economy and personal privacy. Therefore, everyone should think deeply whether they should believe their smart phone too much.
In Hong Kong, It is common to a person using a smart phone, and it is important to state that the popularity of smart phone is increasing. For example, when we are on the street, normally we can see people using Iphone, Samsung galaxy series, etc. It means that smart phone do attract people to use it selves. With the increasing popularity of smart phone , a lot of questions are also raised: Why smart phones are so attractive? How the smart phone change the society? In this essay, this phenomenon will be discussed in a sociology percept. First of all, the reason for the extra high popularity of smart phone will be discussed. The essay will then be followed by discussing the effect of smart phone on the society.
1)The reason for the high popularity of smart phone
There are two reasons explaining why a lot of people choose smart phone rather than mobile phones, mainly ,in terms of security and convenience .
1a) In terms of security
Owing to the fact that Hong Kong is a city of business and a lot of people are working in the business aspect, people need to handle a lot of data of their work and transfer the data to their client through their self phone. Moreover, as some data of their work may be confidential, it Is necessary for the phone to be secure enough so that all the data can be confirmed not to be stolen. For smart phone , since some smart phone are known to be secure, many businessman choose it to help their work. Take blackberry as an example, owing to the fact that the operating system of blackberry are set to be very secure when compared with other phones, blackberry attracts a lot of people to use it . Apart from blackberry, the operating system - Symbian, which is invented by Nokia, is also secure so it attracts many people to use it rather than mobile phone.
1b) In terms of convenience
In the smart phone market, apart from some brands which are very famous in data security, there are also some brands which are famous in the large variety of applications. They are : IPhone OS , Android and Windows mobile. These Operating system provide a large variety of applications. This large variety of applications convince user to do their job. For examples, google maps and bus routes searching application. These applications are very convenient to user to get their job done. Moreover, IPhone OS and Android provide a platform for user to create their own application. This allows applications to have a much higher variety. The characteristic of smart phone that having a lot of applications do attract people very much since it can convince them very much.
2)The effect of smart phone to the society
Since the popularity of smart phone is on the increase, more and more people are affected by this kind of gadget. Therefore, it is important to look at the effect of smart phone on the society.
2a) Boosting the development of application
In the past, application mainly are developed by big companies and people seldom join the development. However, the situation has changed once the smart phone such as IPhone and android system released. Smart phone boost the development of application. The reason is that , as mentioned in above, some smart phone ( IPhone and Android) opens a new platform for user to develop its own application so as to fit their requirement. That is to say, everyone is now have the chance to join the application development. This converge of labor do help the development of new applications.
2b) Open a new market and create new jobs
As mentioned before, some type of smart phone open a new platform for user to share their application. This new platform also create a new market, that is , application market . Take IPhone as an example, Apple company gives a platform called Apple Store for IPhone users to buy applications so as to evaluate their phone. A market is formed which people can buy applications there. Moreover, apart from opening a new market, this new platform also create a new business. Since there is a high demand for applications in the market, some people choose to develop new applications and sell it to other people so as to earn money. This states that Smart Phone do create a new business .
2c) Creating a culture of movable business
Some Smart Phone ,such as blackberry ,are said to be very secure and a lot of businessman to choose to do business through their smart phone. This create a new culture of mobile business that people are now use their selfphone to do business with others. For example, people may sign a contract through smart phone. Therefore, people can now do business everywhere. That is to say, Smart Phone convince businessman to do business in outdoor.
3) Some critical thinking about Smart Phone
Although Smart Phone is said to be very secure, and convenient, it is important for us to think some questions: Do Smart Phone really that good? Do smart phone really secure? Actually, there are many unknown area that we do not know well about smart phone. It is important to state that we should not trust smart phone very much. Even though everyone said that they are secure, it still has the chance of information leakage. Moreover, since your mobile phone always access to the open network, information may be stolen and changed, which may cause a big problem in both economy and personal privacy. Therefore, everyone should think deeply whether they should believe their smart phone too much.
Friday, September 23, 2011
The Role of Smartphones in Medicine
Nowadays, we always discuss about Smartphone with friends or others around us. By the way, what is Smartphone? How smart is it? Simply, Smartphone is a combination of PDA and cell phone. In other words, it has features not only like those we can find on a computer but also making phone calls. Smartphone allows us to install and run many applications. It also let us access Internet. These features make Smartphone popular and become a useful device among different fields, especially in the medical field.
To satisfy health care practitioners' desire, many medical apps are developed and released. For example, medical calculators, clinical resource apps, medical dictionary apps, and apps for patients scheduling, prescription drug reference and electronic health record. We can read reference books, dictionary and patients' records on our Smartphone and thus not much space is taken up for storing the materials. In the old days, doctors and nurses need to write up all the data by hand, and stored them in paper form. The data could be ruined easier simply by a drop of water; as time goes by, ink might run out causes lost of important information about the patient's history. In the case of any emergency, it requires to search for the whole data base store which could be time consuming. However, medical apps can solve these problems now and physicians can search data anywhere and anytime. It also provides a better communication platform for physicians to transfer messages. They can just send out important information to the system through apps, and other colleagues can notice it immediately wherever. It seems convenient for physicians to have a Smartphone.
Nevertheless, in 2009, Software Advice surveyed health care professionals about their preference of Smartphone. According to the survey results, email, note taking and prescription drug reference are popular software among the respondents. They seldom do the clinical related tasks such as checking the medical image viewing and patients' records which are the top two tasks that physicians desire to do with their Smartphone. There seems to be a contradiction because those clinical related tasks are too slow to run or integrate with Smartphone. Therefore, they cannot work with Smartphone on a clinical base.
Apart from this, the growing popularity of Smartphone leads to security problem. Many people do many things with their Smartphone such as checking emails online. This would probably provide an extra platform for hackers to steal personal information from our phones. Furthermore, there is lack of software for securely managing the patient's record at present. If physicians handle the health care information with Smartphone, the patients' record could be leaked out easily. Potential danger of physical theft of Smartphone is also a concern. Smartphone is valuable and can be sold for a good price after all. However, it sometimes may not be stolen by others, but physicians lose it themselves; just like the staffs lost the USB which patients' information was stored a few months before. Therefore, it is not possible for physicians to use Smartphone as a "medical" device.
Like cell phones, long term exposure to Smartphone is harmful for our health. According to the report from Environmental Working Group, the top 10 Smartphone with highest radiation averagely emit 1.53 W/kg radiation, which nearly reach the upper legal limit, 1.6 W/kg. Some may probably argue that we can choose some Smartphone with low radiation. However, we would mostly choose the model based on the functions or appearance of Smartphone. Moreover, from the same research, there is a relationship between prolonged cell phone uses and brain cancer, salivary gland tumors and migraines. Health care professionals are "healer" but not the "killer". They should do no harm to themselves.
At last, Smartphone is an evidence of advanced technology. It is convenient for us to do things whenever and wherever. It also helps us to enhance the relationship with each other. There is nothing wrong with Smartphone, but it is not suitable to use Smartphone as a "medical" device now unless Smartphone has larger loading capacity to run the medical apps, can be protected securely, and emit low radiation. One more important thing is that there should be emergency measures in case of damaged medical apps, system or Smartphone. In the future, Smartphone would become a useful medical instrument.
To satisfy health care practitioners' desire, many medical apps are developed and released. For example, medical calculators, clinical resource apps, medical dictionary apps, and apps for patients scheduling, prescription drug reference and electronic health record. We can read reference books, dictionary and patients' records on our Smartphone and thus not much space is taken up for storing the materials. In the old days, doctors and nurses need to write up all the data by hand, and stored them in paper form. The data could be ruined easier simply by a drop of water; as time goes by, ink might run out causes lost of important information about the patient's history. In the case of any emergency, it requires to search for the whole data base store which could be time consuming. However, medical apps can solve these problems now and physicians can search data anywhere and anytime. It also provides a better communication platform for physicians to transfer messages. They can just send out important information to the system through apps, and other colleagues can notice it immediately wherever. It seems convenient for physicians to have a Smartphone.
Nevertheless, in 2009, Software Advice surveyed health care professionals about their preference of Smartphone. According to the survey results, email, note taking and prescription drug reference are popular software among the respondents. They seldom do the clinical related tasks such as checking the medical image viewing and patients' records which are the top two tasks that physicians desire to do with their Smartphone. There seems to be a contradiction because those clinical related tasks are too slow to run or integrate with Smartphone. Therefore, they cannot work with Smartphone on a clinical base.
Apart from this, the growing popularity of Smartphone leads to security problem. Many people do many things with their Smartphone such as checking emails online. This would probably provide an extra platform for hackers to steal personal information from our phones. Furthermore, there is lack of software for securely managing the patient's record at present. If physicians handle the health care information with Smartphone, the patients' record could be leaked out easily. Potential danger of physical theft of Smartphone is also a concern. Smartphone is valuable and can be sold for a good price after all. However, it sometimes may not be stolen by others, but physicians lose it themselves; just like the staffs lost the USB which patients' information was stored a few months before. Therefore, it is not possible for physicians to use Smartphone as a "medical" device.
Like cell phones, long term exposure to Smartphone is harmful for our health. According to the report from Environmental Working Group, the top 10 Smartphone with highest radiation averagely emit 1.53 W/kg radiation, which nearly reach the upper legal limit, 1.6 W/kg. Some may probably argue that we can choose some Smartphone with low radiation. However, we would mostly choose the model based on the functions or appearance of Smartphone. Moreover, from the same research, there is a relationship between prolonged cell phone uses and brain cancer, salivary gland tumors and migraines. Health care professionals are "healer" but not the "killer". They should do no harm to themselves.
At last, Smartphone is an evidence of advanced technology. It is convenient for us to do things whenever and wherever. It also helps us to enhance the relationship with each other. There is nothing wrong with Smartphone, but it is not suitable to use Smartphone as a "medical" device now unless Smartphone has larger loading capacity to run the medical apps, can be protected securely, and emit low radiation. One more important thing is that there should be emergency measures in case of damaged medical apps, system or Smartphone. In the future, Smartphone would become a useful medical instrument.
Reference
- EEZIPC.com. (n.d.). Radiation from SmartPhones . Retrieved from http://www.eezipc.com/index.php?option=com_content&view=article&id=68&Itemid=57
- International Business Times. (2010, June 23). E-Records Could Be Hazardous to Your Health. Retrieved from http://www.ibtimes.com/articles/30165/20100623/electronic-health-records-hazardous-to-health.htm
- Software Advice. (2009, July 30). Which Smartphone Will Own the Healthcare Market? Retrieved from The Medical Blog: http://www.softwareadvice.com/articles/medical/smartphone-survey-results-1073009/
Sunday, July 24, 2011
Cryptography using key
Problem:
(a) Suppose that there are n people who want to communicate with each other securely. How many keys are needed when a symmetric key cryptosystem is used? How about public key cryptosystem? Explain.
(b) Digital signatures cannot be done using symmetric key cryptography. Explain why.
(c) Suppose we produce a “digest” of a message by simply adding up the words (e.g., treating each character as a 8-bit number). What is the problem of this approach?
Follow-up:
(a) Using symmetric keys, the number of keys required for pair-wise communication is nC2 = n (n –1)/2. Using public key cryptosystem, the number 2 of keys require is just 2n (one public key and one private for each user).
(b) One of the most important requirements in digital signatures is non-repudiation—the signer cannot deny that a signature is produced by him/her. Thus, we need a “secret” that is bound to and only to each user. Using symmetric key cryptosystem, a secret key is known to at least two users and, therefore, a digital signature produced with a secret key cannot be bound to a unique user.
(c) The problem is that a message can be easily transformed into an entirely different message with the same digest, by just re-arranging the characters or words. For example, “car” and “arc” have the same digest.
(a) Suppose that there are n people who want to communicate with each other securely. How many keys are needed when a symmetric key cryptosystem is used? How about public key cryptosystem? Explain.
(b) Digital signatures cannot be done using symmetric key cryptography. Explain why.
(c) Suppose we produce a “digest” of a message by simply adding up the words (e.g., treating each character as a 8-bit number). What is the problem of this approach?
Follow-up:
(a) Using symmetric keys, the number of keys required for pair-wise communication is nC2 = n (n –1)/2. Using public key cryptosystem, the number 2 of keys require is just 2n (one public key and one private for each user).
(b) One of the most important requirements in digital signatures is non-repudiation—the signer cannot deny that a signature is produced by him/her. Thus, we need a “secret” that is bound to and only to each user. Using symmetric key cryptosystem, a secret key is known to at least two users and, therefore, a digital signature produced with a secret key cannot be bound to a unique user.
(c) The problem is that a message can be easily transformed into an entirely different message with the same digest, by just re-arranging the characters or words. For example, “car” and “arc” have the same digest.
Friday, July 22, 2011
Cracking using quantum computing
Comment:
What if quantum computing cracks the theory of public key approach?
Follow-up:
Theoretically, based on Peter Shor’s factorization algorithm, a quantum computer can break a public key cryptosystem in very short time. Thus, public key cryptosystem as we are using it now will become completely useless.
The critical problem of the current public key cryptosystem (the “RSA” algorithm) is that it relies on computational intractability. In other words, its security is not mathematically proven.
Security scientists are actively researching on “provable” public key approaches.
Certificate authority
Comment:
What if the certificate authority discloses private information of users? Safe?
Follow-up:
Yes it is definitely possible that a CA could inadvertently discloses some private information. For example, a CA’s database could be compromised by some hackers, just like the credit-card numbers are disclosed in some hacking of e-business Web sites.
So in a sense, one could argue that our Internet security is quite fragile.
Comment:
Who will certify the public key of the certificate authority?
Follow-up:
A CA’s public key is not “certified” but just published in a widely accessible site so that everyone can verify it.
Are malware and computer virus related to Internet security?
Comment:
Does it mean that we should not use some not-so-famous browser to surf the net because those will lead to risky result?
Follow-up:
Yes definitely. In fact, we should all be very careful in using any software in nowadays computing environment because of the Internet. Specifically, a malicious software (called malware) can extract useful information (e.g., bank statements, etc.) from your computer and then send them off to some remote computers (e.g., the hackers’ computers) for launching further attacks.
We should not trust certificates from unknown sources/companies. We should not trust the “judgment” made by the browsers, which might have been altered by some malwares.
Comment:How about computer virus? (Is computer virus related to Internet security?)
Follow-up:
Computer virus, like “malware” I mentioned above, is highly related to Internet security in the sense that nowadays computer virus is not about making fun of an innocent user (as in the past). Instead, a virus will be used for getting sensitive information and/or using your computer to launch further attacks to others (e.g., Distributed Denial-of-Service attacks, like attacking popular Web sites such as Amazon.com).
Most importantly, a computer virus spreads by using emails or some bogus links in a Web page.
So we have to be careful in opening email attachments and clicking on some Web links.
Is password enough for authentication?
Comment:
Is password enough for authentication? Any other ways for the authentication (like USB keys)? What else can I do to enhance my Internet security?
Follow-up:
Password is definitely not enough. But we do not know what really is enough. Remember the weakest link concept? Thus, to enhance security, we really have to do as much as we can, without compromising efficiency or convenience too much. So it is true that in many situations, some more security measures, e.g., using a hardware key, to couple with password for authentication.
Biometrics (e.g., retina scan, finger-prints, etc.) are also commonly used as further information for authentication.
Subscribe to:
Posts (Atom)